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Under  Contract.  DAAA21-?1:-C-C319>  initiated  in  April  197U,  Southwest 
Research  Institute  (SwRI)  was  tasked  to  design  and  demonstrate  a Deluge 
System  to  extinguish  fires  on  conveyors  following  an  accidental  dentona- 
tion  of  bulk  high  explosives.  Th?  Safety  Concepts  Branch,  Nuclear 
Development  and  Engineering  Directorate  (ND&ED) , Pica tinny  Arsenal  was 
authorized  in  October  197h  to  perfrrm  an  independent  safety  oriented 
design  analysis  and  apply  'Fault  Tree  Analysis  techniques  to  the  SwRI  design 
as  it  was  developed.  The  purpose  of  this  report  is  to  document  this  work. 

Some  of  the  items  considered  herein  may  exceed  the  requirements  in  the 
cited  contract.  However,  a comprehensive  safety  analysis  must  address  all 
components  of  the  system.  Fault  Tree  Analysis  will  provide  an  overall 
systems  approach  and  serve  as  a tool  for  both  Engineering  Management  review 
and  decision  making. 

Fault  Tree  Analysis  was  used  to  investigate  and  identify  the  relation- 
ships and  causes  of  the  undesired  end  event  "no  flow"  or  "improper  flow" 
of  water.  Once  constructed,  the  Fault  Tree  was  used  to  both  qual-i tatively 
and  quantitatively  evaluate  the  entire  system.  The  results  identify 
potential  problem  areas  and  their  overall  impact  on  the  system. 


METHODOLOGY 

The  basic  logic  events  used  for  the  Fault  Tree  were  the  AND  and  OR 
occurrences  necessary  to  cause  the  event  directly  above  it.  The  AND  events 
must  each  occur  before  the  next  event  above  will  occur.  An  OR  event  is  any 
one  of  a number  of  events  which  in  itself  could  cause  the  next  event  above 
it  to  occur. 

Initially,  the  Fault  Tree  developed  was  used  to  determine  the  single 
failure  inodes  which  would  cause  the  undesirable  end  event:  Deluge  System 

Failure.  Each  of  the  design  features  was  related  to  the  undesired  final 
event  working  from  the  top  down.  Each  possible  event  which  could  cause 
failure  was  itemized  in  order  of  occurrence  and,  in  turn,  succeeding  events 
necessary  to  cause  each  of  these  events  to  occur  were  itemized.  Hand 
developed  Fault  Trees  were  then  drawn  up  to  help  visualize  the  complete 
system  based  on  the  list  of  events  visible  to  the  analyst.  In  the  review 
of  the  Deluge  System,  two  simple  trees  were  drawn  up  followed  by  two  more 
detailed  trees.  The  detailed  trees  contained  system  changes  which  appeared 
desirable  in  that  they  presented  AND  logic  failure  responses  to  enhance 
reliability. 

Particular  attention  was  paid  to  those  single  events  which  caused  the 
undesirable  end  event.  Each  single  point  failure  was  reviewed  to  determine 
what,  if  anything,  could  be  done  to  require  more  than  one  failure  to  cause 
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the  end  event.  As  these  single  point  failures  were  developed,  they  were 
pointed  out  to  the  Contract  Project  Officer. 

In  the  initial  approach  to  using  Fault  Tree  Analysis,  one  assumes  a 

probability  of  one  (1)  of  each  event  occurring  and  therefore  attempts  to 

present  system  changes  which  provide  AND  response  requirements  (i.e.,  more 

than  one  failure  event  must  occur)  for  system  failure.  Since  a chain  is 

only  as  strong  as  its  weakest  link,  one  must  continually  look 

for  the  weakest  link  in  the  system  and  attempt  to  provide  the  simplest 

solution  to  strengthen  and  improve  the  condition  as  it  is  seen  to  exist. 

• • 

As  the  Fault  Tree  was  developed,  an  associated  schematic  showing  the 
basic  electrical  and  mechanical  configuration  was  also  developed.  The 
Fault  Tree  was  then  hand  detailed  and  available  computer  programs  (see 
Section,  Computer  Programming  and  Analysis)  were  used. to  draw  the  Fault 
Tree.  A sensitivity  analysis  to  exercise  the  system  with  varying  prob- 
ability rates,  based  on  the  engineering  judgment  of  the  analyst  was  used 
to  determine  soft  spots.  Finally,  more  accurate  probability  rates,  based 
on  failure  rate  data  investigation,  and  varied  testing  and  repair  rates 
were  used. 


DISCUSSION 

The  design  analysis  consisted  initially  of  a comprehensive  review  of 
the  original  documents  available  (reference  1,  2 and  3).  Figure  1 was  a 
result  of  review  of  documents  referenced  above.  Figure  2 was  a result  of 
discussions  (reference  !i)  in  response  to  questions  developed  in  the  initial 
safety  review.  (See  Appendix  A) 

Briefly,  the  system  consisted  of  an  anti-freeze  protected,  unpressurized 
open  pipe  system  with  piping  and  nozzles  located  at  floor  level  on  each  side 
of  the  conveyor  line.  Isolation  from  the  main  pressurized  supply  line  would 
be  provided  by  an  explosively-activated  valve.  Valve  activation  would  be 
provided  electrically  through  a controller  which  received  an  input  from  ultra 
violet,  light  sensing,  fire  detection  heads.  The  controller  provides  an 
electrical  energy  output  to  an  explosive  squib  which  ruptures  a diaphragm 
in  the  valve.  Figure  1 shows  a complete  series  of  OR  functions,  any  one 
of  which  will  cause  NO  FLOW  or  IMPROPER  FLOW  of  water,  representing  system 
failure.  Figure  2 shows  two  (2)  AND  functions  provided,  one  through  re- 
dundant explosive  squibs  in  the  valve,  wired  in  parallel;  and  the  second 
through  redundant  electrical  power,  both  line  and  battery.  The  Fault  Tree 
still  shows  a large  number  of  single  point  OR  functions  which  would  cause 
the  undesired  end  event  to  occur. 

As  a part  of  developing  their  overall  design  concept,  SwRI , under  its 
basic  contract,  developed  and  tested  separate  portions  of  the  final  design. 
During  this  period  of  the  design,  a trip  (reference  6)  to  the  contractor's 
facilities  was  made  to  witness  some  of  the  testing,  further  discuss  design 
progress  and  review  any  available  in-house  and  manufacturers' data  (see 
Appendix  B) . Of  particular  interest  were  observations  of  daylight,  open 
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field  ignition  testing  of  small  quantities  of  flake  TNT.  The  response 
of  a UV  head  to  the  small  flames  was  good  at  distances  up  to  60  feet 
(maximum  distance  tested).  The  flame  was  deep  orange,  relatively  mild, 
and  slow  burning.  Combustion  occurred  with  large  amounts  of  heavy  black 
smoke.  Extinguishment  of  the  flame  occurred  very  rapidly  in  the  order  of 
a few  seconds.  Sunlight  had  no  effect  on  the  UV  head.  It  only  responded 
when  ignition  of  the  Flake  TNT  occurred. 

The  analysis  took  into  consideration  observations  made  on  the  flake 
TNT  fire  testing  at  SwRI  (reference  6),  acquisition  and  review  of  manu- 
facturer's data;  discussions  with  Detector  Electronics  Corp.  (reference  7), 
one  manufacturer  of  UV  response  systems;  discussions  with  Grinnel  Sprinkler 
Co.  regarding  a black  powder  installation  at  Indiana  Array  Depot  (reference  8) 
and  discussions  with  Lea  Engineering  of  Pittsburg  on  a Bureau  of  Mines  pro- 
gram covering  methane  gas  explosions  in  mines  (reference  9).  A search  of 
the  literature  for  alternate  means  of  control  and  extinguishment  in  Deluge 
Systems  was  also  conducted. 

Based  on  all  considerations  mentioned  above,  a study  of  the  possible 
basic  piping  layout  variations  and  a study  of  UV  head  spacing  and  coverage, 
a Schenatic  of  a proposed  base  lina  design  (Figure  3)  and  two  (2)  iterations 
of  a final  Fault  Tree  (Figures  h and  5)  were  developed.  The  design  analysis 
and  the  computer  program  analyses,  applied  to  the  design  shown  in  Figure  3, 
are  covered  in  the  succeeding  paragraphs  of  this  report. 
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ANALYSIS  OF  BASELINE  DESIGN 


line  of  supply  pipe.  designed  Co  sustain  explosive  action.  Small 
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distance  from  explosive  exposure. 


DESIGN  FEATURE  BASIS  FOR  DESIGN  FEATURE 


be  twice  that  of  the  sprinkler  heads 
two  controllers  could  handle  a total 
conveyor  length  of  240'.  A series  o 
eight  (8)  sprinklers  on  15'  spacing 
will  handle  a length  of  120'. 


COMPUTER  PROGRAMMING  AND  ANALYSIS 


Using  the  Schematic  shown  in  Figure  3,  and  final  Fault  Tree  iterations 
developed  as  shown  in  Figures  1*  and  5,  several  computer  programs  were 
employed  to  perform  further  analysis  of  the  Fault  Tree.  Each  of  the  pro- 
grams referenced  herein  was  previously  inputed  to  the  computer  on  other 
study  programs  and  is  available  on  permanent  file.  A basic  understanding 
of  CDC-6600  SCOPE  control  cards  and  file  processing  is  required. 

The  SETS  (reference  10)  program  was  used  to  record,  in  proper  computer 
language,  each  of  the  Deluge  System  Fault  Tree  AND  and  OR  Gate  events,  in- 
puts and  outputs.  The  SETS  program  requires  that  all  hand  developed  tree 
GATES,  of  three  or  more  inputs,  be  reduced  to  two  input  logic  GATES  and 
then  recombined  to  accomplish  the  equivalent  logic . 

The  second  program,  implemented  on  the  CDC  6600,  was  FTD  (reference  11). 
The  program  produces  a control  tape  for  drawing  the  Fault  Tree  on  an  off- 
line CalComp  Plotter.  Due  to  built-in  program  limits  on  overall  width  and 
height  adjustment,  some  difficulty  was  experienced.  The  program  was  first 
modified  to  remove  the  width  limitation.  The  resultant  Fault  Tree  is  shown 
in  Figure  6.  The  input  data  was  modified  again  to  use  the  maximum  plot 
height  on  the  CalComp  Plotter.  The  result  is  a more  legible  tree  which  can 
be  used  as  an  effective  working  tool.  It  is  somewhat  cumbersome,  however, 
for  inclusion  in  a report.  Once  the  Fault  Tree  has  been  programmed  and 
proven  out,  changes  can  be  easily  made  and  a new  tree  drawing  plotted  in  a 
minimum  of  time. 

Computer  programs  PREP  and  KITT  (reference  12)  were  enployed  for  auto- 
matic evaluation  of  the  Fault  Tree.  The  PREP  program  was  used  to  obtain 
the  minimal  cut  sets  of  the  Fault  Tree,  and  the  KITT  program  was  used  to 
obtain  the  numerical  probabilities  associated  with  the  tree.  PRFD  deter- 
\ mines  the  minimal  cut  sets,  either  by  Monte  Carlo  simulation  or  by  deter- 

mination testing.  KITT  determines  the  numerical  probabilities  by  means  of 
Kinetic  Tree  Theory,  a methodology  by  which  exact,  time  dependent  probabil- 
istic information  is  obtained.  In  the  KITT  program,  non-repairability  or 
maintenance  and  testing,  and  constant  repair  times,  can  be  evaluated. 

The  basic  events  (causes)  of  the  Fault  Tree  are  termed  "component 
failures",  and  the  top  event  of  the  Fault  Tree  is  termed  the  "system  failure". 
Once  constructed,  the  Fault  Tree  is  first  evaluated  to  obtain  the  unique 
modes  by  which  the  system  failures  can  occur  and,  secondly,  to  obtain  the 
associated  probability  characteristics.  The  unique  modes  of  occurrence 
are  termed  minimal  cut  sets . A cut  set  is  formally  defined  as  any  set  of 
system  components  which  when  simultaneously  failed  cause  the  system  to  be 
in  the  failed  state.  A minimal  cut  set  is  a smallest  group  (set)  of 
component  failures  which  must  all  simultaneously  exist  in  order  for  a 
system  failure  to  exist.  Any  other  component  failures  may  coexist  with 
this  smallest  set,  but  these  other  component  failures  are  entirely  re- 
dundant and  do  not  directly  cause  the  system  failure.  The  finite  collec- 
tion of  all  the  unique  minimal  cut  sets  of  a Fault  Tree  represents  all 
the  unique,  nonredundant  ways  by  which  the  system  failure  can  occur.  The 
system  failure  can  only  occur  by  one  of  these  unique  ways  or  by  various 
combinations  of  these  unique  ways. 
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FIGURE  6 

FAULT  TREE,  COMPUTER  - CALCOMP  PLOTTER 
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After  having  obtained  the  minimal  cut  sets,  the  Fault  Tree  is  then 
evaluated  to  obtain  the  probability  characteristics.  The  probability 
characteristics,  outlined  in  Table  1,  are  obtained  not  only  for  the 
System,  but  for  each  minimal  cut  set  identified  in  the  Fault  Tree.  From 
this  detailed  information,  the  importance  of  various  components  and 
minimal  cut  sets  can  be  simply  ascertained.  Moreover,  the  characteristics 
may  be  obtained  for  any  given  intervals  of  operating  time  (mesh  size)  over 
the  total  elapsed  time  period  of  interest. 


TABLE  1 


PROGRAM  DATA  IDENTIFICATION 


DIFFERENTIAL  CHARACTERISTICS 


PROGRAM  SYMBOL 


1.  Probability  of  failed  state 
at  time  t (Failed  Probability) 

2.  Expected  # of  failures  suffered  per 
unit  time  at  time  t (Failure  Rate) 

3.  The  failure  intensity  with  respect 
to  time  t (Failure  Intensity),  i .e. , 
Lambdas  ( x 's)  for  cut  sets  and 
systems 


INTEGRAL  CHARACTERISTICS 


PROGRAM  SYMBOL 


1.  Expected  ft  of  failures  suffered 
during  the  time  interval  from 
o to  t 


2.  The  probability  of  suffering  one 
or  more  failures  during  the  time 
interval  from  o to  t 


To  obtain  the  probability  characteristics  defined  in  Table  1,  in 
addition  to  the  Fault  Tree  itself,  one  must  provide  as  input,  the  proba- 
bility of  component  failure  per  hour  (failure  rate)  P (T). 

Initially,  failure  rates  were  arbitrarily  chosen  on  the  basis  of 
one  (1)  failure  in  three  months,  1 year,  and  2-1/2  years  and  assigned  to 
those  events  determined  to  be  most  likely,  likely,  and  least  likely  to  occur. 
Using  these  time  periods  the  values  of  P(T)  were  determined  to  be; 

1 A 

P(T)» - U63  X 10”° 

2160 


P(T)-  1 - 138.9  X 10 

7500 


P(T)-_1  - U6.3  X 10-6 

51556 

The  failure  rate  is  related  by  exponential  distribution  to  the  failure 
intensity  ( x)  as  follows: 

P(T)  - 1 - exp  (-  \T)  (X) 

Fro*  equation  (1),  above,  the  failure  intensities  ( A ■ s)  for  each  consonant 
were  then  determined  to  be  of  the  order  U.63  x 10"  , 1.38  x 10"  , and 
U.63  x 10"5  respectively.  (See  Table  2,  Run  3.)  The  failure  intensity 
( X ) of  each  component  is  assumed  to  be  constant  with  respect  to  time. 
Further,  all  the  components  are  assumed  to  be  in  their  operating  state  at 
».j*e  aero.  The  component  failures  on  the  Fault  Tree  are  assumed  in- 
dependent; any  component  failure  may  occur  at  numerous  places  on  the  Fault 
Tree,  but  those  component  failures  which  are  distinct  are  assumed  in- 
dependent. 

The  Fault  Tree  is  first  input  in  a simple  coded  form  to  the  PREP 
computer  program  to  obtain  the  minimal  cut  sets.  The  output  from  the  IHKP 
program,  with  the  addition  of  failures  Intensities  ( X ) and  repair  rates 
( t ),  is  then  input  to  the  K1TT  program  to  obtain  the  tine  dependent, 
numerical  probabilities.  The  KITT  program  is  a single  phase  component 
program;  i.e., each  component  may  have  only  one  failure  intensity  X . The 
program  may  be  applied  with  and  without  repair  times  t for  each  component. 
Only  one  repair  rate  t may  be  used  for  the  total  elapsed  operation  time 
(or  be  non-repairable  for  all  time). 

The  differential  characteristics  and  the  integral  characteristics  are 
obtained  for  each  minimal  cut  set  and  the  full  system  at  operating  time 
intervals  specified  by  the  user.  Differential  characteristics  are  point- 
wise  quantities,  being  obtained  at  a point  in  time.  Integral 
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characteristics  are  a summation  of  failures  or  probabilities  of  one  or  more 
failures  over  a period  of  time  from  o to  t. 

SUMMARY  OF  COMPUTER  PROGRAM  RESULTS 

A total  of  sixteen  (16)  runs  were  made  on  the  computer.  Three  (3) 
used  the  PREP  program  to  determine  the  minimal  cut  sets,  and  setup  the 
required  input  data  to  the  KITT-1  program.  Since  a major  AND  function 
occurs  at  the  top  of  the  tree,  the  effects  on  the  system  were  determined 
by  comparing  one  half  of  the  tree  to  the  ANDed  full  tree.  The  PREP  program 
produced  a series  of  twelve  (12)  single -element  cut  sets  for  the  half  tree 
and  a series  of  one  hundred  and  forty  four  (1UU)  two  element  cut  sets  for 
the  full  tree. 

The  balance  of  thirteen  (13)  runs  used  the  KXTT-1  program.  Runs 
identified  in  Table  2 by  numbers  3,  U , 5,  6,  7 and  11  were  on  the  half  tree 
and  run  numbers  9,  10,  12,  13,  111,  1$  and  16  were  on  the  full  tree. 

Initially  a sensitivity  analysis  of  the  half  tree  was  programmed  to 
determine  the  smallest  lambdas  ( X ) values  necessary  to  show  an  acceptable 
system  response.  An  acceptable  system  response  was  defined  as  one  in  which 
the  system  Wsura  and  FSUI)1  were  both  less  than  one  (1) , preferably  closer  to 
.01,  for  the" total  uime  frame  of  2-1/2  and  3 years.  Based  on  the  initially 
assumed  values  of  P(T),  probability  of  failure  per  hour,  the  appropriate 
values  of  lambdas  were  calculated  and  used  in  the  KTTT  program.  The 
lambdas  were  then  varied  by  one  order -of -magnitude  in  each  category.  No 
testing  and  repair,  or  testing  and  repair  rates  of  six  months  were 
arbitrarily  used  to  determine  their  effect.  Runs  3,  h and  $,  using  a 's 
of  U.68  x 10",  1.38  x lO"**  and  U.63  x 10"?,  did  not  produce  an  acceptable 
response  as  defined  above.  Runs  6 and  7,  which  used  two  orders  of  mag- 
nitude change,  i.e.,  X 's  of  U.63  x 10r6,  1.38  x 10“^  and  U.63  x 10“', 
produced  Wgum  and  Fsum  values  considered  acceptable.  The  use  of  a six 
month  test  and  repair  rate  in  run  7 does  not  indicate  sufficient  change  over 
run  6 to  merit  use  of  a six  month  rate. 

Runs  9 and  10  employed  the  full  tree  using  the  same  lambdas  as  Run  3, 
with  and  without  six-month  test  and  repair  rates.  The  resulting  W5um 
and  Fsura  values  were  unacceptable. 

Runs  11  and  12  exercised  the  half  tree  and  full  tree  at  constant 
lambdas  of  1 x 10"?.  Both  produced  results  which  were  acceptable.  A 
comparison  between  Runs  11  and  12  indicates  two  to  three  orders -of-magni- 
tude  improvement  with  the  full  tree. 

A final  review  of  the  probability  of  failure  rates  P(T)  of  each  event 
was  made  to  determine  lambdas  values  considered  to  be  most  reasonable  and 
practical.  From  data  available  (references  13  and  lU) , a range  of  failure 
rates  from  15  x 10“°  to  8.8  x 10*®  appears  reasonable.  Increasing  these 
values  by  two  orders-of-  magnitude,  to  assure  conservatism,  failure  rateB 
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TABLE  2 


I 


SUMMARY  OF  COMPUTER  PROGRAM  RESULTS 


FAILURE 

REPAIR 

OPERATING  TIME 

TOTAL 

RUN 

INTENSITY 

( (O 

TIME 

INTERVAL 

ELAPSED 

If 

< r ) 

(MESH  SIZE) 

TIME 

q 

W 

3 

4.63x10'^ 

0 

6 mos . 

2 1/2  yrs 

9. 9~X/1 

-3  — " 

2.1  J/.H 

1.38x10";* 

4.63xl0"5 

4 

4.6xl0'5 
1 . 38x10”? 

0 

6 mos. 

2 1/2  yrs 

3.8'1/9.9"1 

-4  -f 

2.2  /1.0 

4.63x10 

5 

tt 

6 mo  8 . 

3 mos . 

3 yrs 

3.8~1/5.9_1 

—4  . - < 

2.2  / 1 . 9 

6 

4.6xl0_6 

0 

3 mos. 

3 yrs 

4.6~2/4.3“1 

2.2"5/2.1 

1.38x10  7 
4.63x10 

7 

ft 

6 IT.OS. 

3 mos . 

3 yrs 

4.6"2/9.0'2 

2. 2~  5 / 2 . 2~ 

9 

4.63x10*^ 

0 

3 mos . 

3 yrs 

9.9-1/l 

7.7"3/1.7~ 

1.38x10";* 
4. 63x1 0"5 

10 

II 

6 mos. 

3 mos . 

3 yrs  9. 9~1/1/9.9~1/1 

7 . 7_3/7 . 2~ 

11 

lxlO"7 

0 

3 mos. 

3 yrs 

2 . 6_ 3 / 3 . 1~ 2 

W - L 

12 

lxl0~7 

0 

3 mos. 

3 yrs 

6.9_6/9.9"4 

W - L 

13 

l.Uxio';* 

0 

3 mos. 

1 yr 

-3  -1 

7.0  /1.0 

6.5"6/2.3~ 

1 . 14x10  7 
1.14x10" 

14 

II 

1 mo. 

3 mos. 

1 yr 

-4 

7.9  const. 

W - L 

15 

II 

1 yr. 

3 mos. 

1 yr  ; 

1 . 0~3/l . i_1 

6.5~6/2.3“ 

16 

II 

3 mos. 

3 mos. 

-3 , -1 

1 yr  7.0  /6.9 

6.5-6/6.4‘ 

NOTES : 

+ 3 values 

of  Jl  shown 

represent  least  likely,  likely. 

and  most  likely  event  occul 

* Number  exponents  are 

xlO,  i.e. , 1.8  * ■ 

1.8xl0_1. 

-1  . . 

Figures  represent  beginning  of  cycle  and  end  of  total  elapsed  time,  i.e.,  1.8  A/9.1 


Values  in  between  are  not  shown. 

Runs:  3, 4, 5, 6, 7,  & 11  present  data  on  one  half  of  fault  tree. 

9,10,12,13,14,15  & 16  present  data  on  full  fault  tree. 


Runs: 


TABLE  2 


IARY  OF 

COMPUTER  PROGRAM  RESULTS 

SYSTEM  . ...  - - - 

— — 

TIME 

TOTAL 

TAL 

ELAPSED 



DATA  * 

W 

F 

m. 

TIME 

q 

W 

L 

sum 

sum 

2 1/2  yrs 

9 . 9— 1 / 1 

2.r3/.n"3 

2.2"3/2.110/1.610 

6.2/11.09 

1.0  const 

2 1/2  yrs 

3.8_1/9.9_1 

-A  -4 

2.2  /1.0 

-4  -2 
2.2  /3.1 

-1 

4/6  / 3 . 9 

4.5_1/1 

3 yrs 

s.s'Vs.g-1 

2.2_4/1.9~4 

-4  -4 

2.2  /4. 6 

4.6~1/8.8~1 

-1  -1 
4.5  /9.9 

3 yrs 

4 . 6-2/4 . 3-1 

-5  ~5 

2.2  72.1 

-5  ~5 

2.2  /3.5 

4.8-2/5.5_1 

4.8~2/5.2_1 

i 3 yrs 

4 . 6-2/9 . 0-2 

2.2_5/2.2'5 

2.2“5/2.4“5 

4.7~2/5.6~1 

4.7_2/4.6_1 

, 3 yrs 

9 . 9— 1 / 1 

7 . 7_ 3 / 1 . 7~3 

+3  +12 , +10 
5.0  /1.0  /1.0 

8. 5_2/1.0 

1.0  const 

. 3 yrs 

9.9"1/1/9.9"1/1 

-3  -2 

7.7  77.2 

+3 , +12 

5.0  /1.0 

8.5/24.8/42/2 

.4  1.0  const 

> 3 yrs 

-3  -2 

2.6  73.1 

W - L 

1 . 2xl0~6 

2.6_3/3.1-2 

2.6-3/3.r2 

» 3 yrs 

6.9_6/9.9_4 

W - L 

-9  -8 

6.3  / 7 . 5 

-6  -4 

6.9  /9.9 

6.9_6/9.9'4 

> 1 yr 

-3  -1 

7.0  71.0 

6. 5_6/2 . 3~5 

6.5_6/2.6~5 

-3  -1 

6.9  J/l.l 

7.o_3/i.r1 

1 yr 

-4 

7.9  const. 

W - L 

-6 

2.2  const. 

-3  -2 

2.4  /1.6 

2.4_3/1.6~2 

-1 

_3  _1 

1 yr 

-3  -1 

7.0  -71.1 

6.5_6/2.3_5 

6.5_6/2.6~5 

6 . 9~3/ 1 . 1 

7.0  /l.l 

1 yr 

7. 0_3/6. 9_1 

-6 

6.5  /6.4 

-6  -6 
6.5  / 6 . 4 

-3  -2 

6.9  /4.9 

7.0~3/4.8~2 

last  likely,  likely, 
l.8_1  - 1.8xl0-1. 

and  most  likely 

event  occurence. 

1 and  end  of  total  elapsed  time,  i.e 

.,  1.8-1/9.9-1. 

on  one  half  of  fault  tree. 

( data  on  full  fault 

tree. 
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of  8.8  x 10”6  for  the  least  likely  event  to  occur,  8.8  x 10”  for  the 
likely  event,  and  8.8  x 10-^  for  most  likely  event  were  selected.  Lambdas 
were  then  computed  from  aquation  (1)  and  used  in  Runs  13,  lit,  15  and  16. 

In  addition  tau,  test  and  repair  rates  were  varied  for  intervals  of  one 
month,  three  months,  and  one  year  for  a total  time  period  of  one  year.  All 
runs  show  acceptable  values  of  WSUm  and  Fsum.  The  effects  of  test  and 
repair  on  a three-month  or  one-month  rate  were  considered  significant.  The 
W3ura  and  Fsum  values  at  the  end  of  the  operating  time  interval  decrease  by 
an  order- of  magnitude,  i.e., .11  at  one  yea r,  without  test  and  repair,  to 
• 0L9  at  three-month  test  and' repair,  to  .016  at  one-month  test  and  repair. 

An  illustration  of  a typical  computer  run  for  both  the  PREP  and  KITT 
programs  is  shown  in  Appendix  C. 


CONCLUSIONS 

1.  Fault  Tree  Analysis  can  be  effectively  used  on  the  subject  deluge 
system  and  other  more  complicated  Manufacturing  Technology  Programs . It  is 
evident  herein  that  the  use  of  Fault  Tree  Analysis  will  provide  a safety 
design  review  that  points  out  problem  areas  early  in  the  development  cycle. 
The  Fault  Tree  Analysis  approach  forces  one  to  look  critically  at  all 
possible  problems  which  night  develop. 

2.  Fault  Tree  Analysis  of  the  system,  as  it  appears  to  be  developing, 
indicatesthat  twelve  (12)  single -point  failures  exist  which  could  cause 
Deluge  System  failure.  Nine  (9)  of  these  single- point  failures  can  be 
eliminated  ANDing  the  nozzle  lines.  This  can  be  accomplished  by  supplying 
the  nozzle  lines  on  either  side  of  the  conveyor  separately  through  a line 
using  its  own  fill  system  and  controlled  explosive  valve.  That  is,  each 
side  would  be  independent  except  for  the  main  water  supply  line.  This  would 
eliminate  9 of  the  12  single-point  failures.  The  remaining  three  are  main- 
line failures  which  could  be  monitored  by  a line  pressure  sensing  device 
associated  with  a system  interlock  and  an  audible  or  visual  alarm. 

3.  Fault  Tree  Computer  Analysis  of  the  proposed  base  line  design 
shows  the  need  for  a periodic  testing  and  repair  procedure  to  assure  the 
reliability  of  the  Dsluge  System. 

U.  The  type  of  fire  which  could  result  from  any  explosive  considered 
for  use  with  the  subject  Deluge  System  should  be  more  completely  charac- 
terized. The  TNT  scale  fires  demonstrated  at  SwRI  were  not  of  a violent 
burning  nature.  If  this  is  typical  of  the  fire  to  be  expected,  there  is  no 
need  for  special  solid  spray  nozzles  and  pressure  regulation.  This  would 
reduce  the  number  of  failure  modes  considerably,  and  no  doubt  reduce  system 
complexity  and  cost. 

5.  Bach  excess  flow  control  valve  used  in  the  system  represents  a 
failure  point.  Elimination  of  these  valves  coupled  with  more  emphasis  on 
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the  explosive  protection  of  nozzles  and  piping  appears  necessary  to  in- 
crease the  safe  and  desirable  response  of  the  deluge  system.  Cost  savings 
in  eliminating  the  excess  flow  valves  can  be  applied  to  the  added  cost  of 
nozzle  and  pipe  protection.  Piping  external  to  the  building  and  earth 
protection  has  been  previously  suggested.  (See  Appendix  B) 

6.  Operation  of  the  conveyor  system  should  be  interlocked  with  the 
Deluge  System  in  such  a way  that  malfunction  of  the  sensing  devices  and 
controller  will  not  allow  operation  of  the  conveyor. 

7.  Powering  of  the  protection  system  could  be  interlocked  with  the 
conveyor  operation.  There  is  no  need  to  power  the  system  constantly  if  it 
can  be  concluded  that  a fire  hazard  does  not  exist  in  the  area  at  times 
other  than  when  actually  conveying  explosives. 


RECOMMENDATIONS 

1.  A Fault  Tree  Analysis  on  the  final  design  be  developed. 

2.  Additional  investigation  be  performed  on  failure  probability  rates. 

3.  Each  possible  failure  event  in  the  final  system  be  reviewed  to 
determine  test  and  repair  or  replacement  rate. 

U.  A test  and  repair  procedure  be  developed. 

5.  The  feasibility  of  a permanent  monitoring  system  in  conjunction 
with  a mini- confute r printout  system  to  provide  quick  response,  periodic 
test  data,  be  investigated. 

6.  Monitoring  of  line  pressure,  suitable  interlocks  with  the  deluge 
and  conveyor  systems , and  suitable  audible  or  visual  alarms  be  provided  in 
the  final  design. 
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appendix  a 


FAULT  THEL  .MiALYSIC  - BULM  HE  CONVEYORS 


Period  Covered:  10  October  to  13  December 

The  work  accompli shed  ar.d  historical  sequence  of  events  for  the  above  period 
is  outlined  be_cv: 

1.  A preliminary  mee’  is.-  with  Messrs.  Rindner  and  Seals  of  MTD  and  Messrs. 
Reiner  and  Coffey  of  SDficED  was  held  on  10  October  l?7b.  Mr.  Reiner  reviewed 
Fault  Tree  Analysis  objectives  and  procedures.  A meeting  with  the  Contractor, 
SvRI  was  agreed  to  at  this  time  tentatively  scheduled  for  early  November. 

We  were  requested  by  Mr.  Rindner  not  to  expend  any  effor'  'until  this  meeting 
was  held. 

2.  Mr.  Rindner  advised  Mr.  Coffey  In  a telephone  conversation  of  3 November, 
that  he  planned  to  visit  SwRI  during  week  of  11  iiovemher.  He  wished  to 
first  review  contractors  progress  before  our  efforts  proceed. 

3.  A preliminary  Ffeu.lt  Tree  was  developed  by  Mr.  Coffey  based  on  the  lata 
available  from  Scope  cfV.or  . , SwRI ’ r proposal,  and  progress  reports  ?1  to 

$5.  Copies  of  sane  were  furnished  Mr.  l.lndner  d'trir.  a meeting  of  22  November 
with  hr.  McLain  cf  SWRI.  A :opy  is  attached  for  reference. 

b.  Ba^c-d  on  discussions  with  Dr.  McLain,  in  the  above  meeting.  supplemented 
by  information  Supplied  in  SwRI  Pro  -.r.jr-s  Reports  -a  anc  =7,  extended  develop- 
ment of  the  pre 1 iminary  I 1 »lt  free  has  been  accomplished.  Three  (3)  copies 
of  this  are  attached  hereto. 

5.  As  presently  developed,  it  appears  'hat  many  sir.rle  point  failures  to 
urovide  no  flew  or  improper  flow  in  the  Deluge  System  can  occur.  Of  particu- 
lar sLTifLcar.ce  will  be  the  zone  size  and  piping  layout  supplying  the  noz- 
zle arrays  in  each  zone.  There  are  many  possible  alternatives.  Various 
arrangements  In  this  area  are  being  considered  for  suggestion  to  MTD  based 

on  their  effect  on  the  Fault  Tree.  It  also  appear-  -hat.  a second  parallel 
method  of  sensin'  and  triggering  the  system  would  be  worthy  of  sonsiderat  ior.. 

6.  Updated  system  de-i-n  data  and  manufacturer’s  details  will  be  required 
♦'or  further  developnen  of  the  vault  Tree.  It  is  expected  that  this  informa- 
tion vlli  be  a/ailable  shortly.  Contact  will  be  made  with  Lr.  McLain  after 
first  discussing  w th  Hr.  Rindner. 
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7.  Wirin'  diagrams,  manufacturer ’s  specifications,  electrical  component  details 
’ .c-chanioai  details  or  ,he  following  items,  where  applicable,  will  help  to 
er  ex-  and  and  detai-t  tne  Fault  Tree: 

a.  Sensing  System 

b.  Explosive  Valve 

c.  Proof  Test  Valve 

d.  Excess  Flow  Valve 

e.  Pressure  Regulating  Valve 

Respectively  Submitted, 


APPENDIX  B 


2 V January  1 75 


TRIP  REPORT 


PLACE  VISITED:  Southwest  Research  Institute,  San  Antonio,  TX 

DATE  OF  VISIT : 23-24  January  1 75 

PURPOSE  OF  VISIT: 

Review  all  design  data  available  vhi ch  can  be  used  on  faul’  tree 
analyses  ieing  developed  by  Safety  Concepts  Branch. 

. witness  testing  con  temp bated  during  time  of  visit. 

3.  Review  requirements  of  project  as  defined  In  Scope  of  Worn  and  SvRI's 
proposa.  in  order  to  become  familiar  with  problems  yet  to  « solved,  current 
th  niiip  In  their  solution,  am.  to  appraise  WID  of  progress  to  date. 

PfdlSiNMLL  CORTACTED: 


Dr.  WJI.  McLain,  liana, -er  lire  Research  Section 
Mr.  I.. A.  Eggleston,  Senior  Research  Engineer 
Mr.  ' .B.  Herrara,  Senior  Research  Engineer 


Discinsion : 

:tr.  McLain  review  details  of  testing  they  were  presently  tryin-  to 
accoci-v  tp,h.  Namely,  cliaracterlzing  the  type  of  burning  a TUT  fire  would 
ore sen'  and  the  sensing  device  response  at  varying  distances.  He  also  indi- 
cate.! r.:inr.(  during  these  tegts,  the  TNI1  fire  response  to  water  extinguish 
meiit  ou  u be  verified.  Data  on  nozzle  patterns  and  density  had  been  taken 
previously  at  SvRl  and  ;ere  available.  Advance  data  on  tests  described 
herein  were  ham!  carried  by  ttte  writer  to  be  turned  over  to  Mr.  Rinclner. 

'b-RI  drawings  eoverirt  design  details  of  a prototype  installation 
assembly  were  dlscu89ec  and  reviewed  by  the  writer  with  Dr.  Mclaln.  Full 
size  details  will  be  used  for  final  Lardvare  verification  and  60#  flake 
TIT.’  de  oration  testing  of  prototype  design.  Seated  models  (%  size)  will 
be  ust-d  to  determine  detonation  effects  on  two  types  of  spray  nozzle  pro- 
tection housings.  Copies  of  S»HI  drawings  D-03-3'U4->  1 to  O')  were  hand 
carried  tor  delivery  to  Mr.  ltlndner  also. 

' detailed  review  of  the  task,  items  covered  in  the  SwRI  response  to  the 
orlritwiJ  Scope  of  Work  ipipearo  t.o  indicate  that  Task  I is  essentially  com- 
pleted. Dr.  McLain  feels  that  their  survey  work  covered  the  known  conveyor 
lines  in  operation  at  tt*e  time.  There  were  no  operations  of  a closed  hood 
■ ype  brought  to  his  attention.  SwRl's  response  lies  been  directed  to  the 
condi  Ions  present  at  the  time  of  their  survey. 
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With  respect  to  Task  XI  most  of  the  work  hss  boon  completed.  The  basic 
approach  and  design  parameters  art  essentially  selected.  Dr.  McLain  con- 
cedes that  perhaps  It  would  he  mere  advisable  to  locate  piping  between  spray 
not  tie  protection  housings  outside  the  building  per  las  ter  below  ground  and 
will  probably  nake  ghat  e final  reoc— ndatlon.  Be  also  state*  that  the 
-ho°P  to  lhO°F  teaperaturs  range  appears  acre  of  a fielded  ltea  specification 
requirement  and  not  neoesearlLy  representative  of  true  enrlrcments  in  this 
application.  Dr.  McLain  expensed  a desire  to  work  closely  In  all  areas 
with  the  writer  and  suggested  a close  Uddtton  In  respect  to  reliability, 
cost  effectiveness,  repair  and  maintenance  review  and  search  for  eddltlorwa 
applications . 

Task  m involves  tbs  eons traction  end  testing  of  small  soale  and  full 
scale  prototype  components  and/or  installations  ■ Sons  of  this  testing  was 
witnessed  by  the  writer.  Drawings  and  preparations  are  In  process  to  cen- 
piste  this  task,  however,  Dr.  Mala  In  lndloated  that  he  expected  to  request 
a three  month  contract  extension. 

Daylight,  open  field  testing  of  a Of  sensing  device  located  5'  above 
and  IV,  29'  and  60'  from  the  source  of  e flake  TWT  tin  were  conducted  on 
23  and  2k  January  1975*  The  fire  was  started  by  inserting  a B1  chrome  resis- 
tance wire  In  a containing  area  of  1 " dla,  V'  x V,  or  8"  x 8"  to  a leveled 
depth  of  approximately  flake  HPT.  When  e varlac  regulated  voltage  of 
approximately  kO  volts  wee  applied  the  Blehrcne  wire  glowed  red.  within  5 
to  10  seconds  a small  amount  of  smoke  appeared  followed  by  flams  Ignition 
whloh  soon  covered  the  entire  surface . The  deep  orange  flams  was  relatively 
mild  and  slow  burning.  Combustion  occurred  with  large  amounts  of  heavy 
black  smoke.  Weights  of  BTP  used  were  70,  140,  700,  1400,  and  5000  grains. 
The  ramber  of  sensor  counts  for  each  seoood  of  flaae  time  were  recorded. 

Extinguishment  of  the  fine  oecurs  very  rapidly  In  the  order  of  a few 
seconds.  The  tests  were  conducted  using  * garden  hose  and  noasla  aet-vgi 
with  a flow  meter  In  the  line.  Splashing  of  the  molten  TWT  occurred  but  no 
re -Ignition  resulted.  Water  quantities  of  the  order  of  .2  gals/sq.  ft. /min. 
were  adequate,  final  design  of  system  will  provide  .3  gals/sq.  ft. /min.  \a 
a minimise 

With  respect  to  Task  XV,  technical  data  package,  drawings  art  being 
generated,  teat  data  accumulated,  and  cuspoaent  manufacturer's  date  is 
available.  In  addition  to  Svri  drawings  mentioned  above,  the  writer  has 
obtained  a large  portion  of  the  manufacturer 'e  data  for  further  use  In  our 
Dkult  tree  analysis . This  Included  parts  list,  excess  flow  valves,  noczlas, 
explosive  value,  aad  description  of  operation  and  wiring  liar—  on  the  ITT 
detectors.  Additional  information  as  required  will  be  obtained  directly 
from  the  specific  manufacturer . 


CCHCIjUbIOM  s 

Dr.  Me  1*1  n VU  not  certain  the  Scops  of  Wort  actually  required  more  than 
proof  of  a arrival  and  activation  of  delugs  system  aftar  datamation  of  a 6c# 
box.  A Joint  rarlav  of  both  tha  Scope  of  Hoik  and  SwRX'a  proposal  clearly 
Indicates  a requirement  to  extinguish  a fire  aa  a result  of  a detonation. 

3vRI  will  plan  to  eat  a representative  firs  If  no  firs  arises  aa  a result  of 
Initial  detonation. 


There  is  data  available  to  la&lsate  that  a boot  of  OT  Ignited  aoroes 
its  top  surface  will  detonate  after  burning  down  In  part  way.  ft*  tlaelhetween 
Ignition  and  detonation  la  therefore  critical.  The  deluge  system  total  response 
tine  after  survlvlaf  tha  initial  detonation,  sensing  a fire,  and  then  extingu- 
ishing the  fire  auet  be  neanurably  less  than  the  secondary  detonation  tine. 

If  the  extinguishment  aye  ten  does  not  function  properly  ee  could  have  a con- 
tinuing series  reaction  up  the  line. 

The  detonation  any  vary  from  ho  to  60  # HR  equivalency.  A kO  # equiva- 
lency will  result  In  a greater  norther  of  burning  brans,  which  together  with 
parts  of  the  burning  box,  travel  a short  distance.  A pressure  wavs  will 
occur  and  adjoining  banes  nay  be  sewed  dogn  the  conveyor  or  off  to  the  sides. 
Characterisation  of  the  detonatiea  and  expected  side  effhots,  If  not  already 
known,  should  be  date ruined. 


fSCOMOBMncaB: 

A clear  definition  of  all  teats  to  be  oondueted  to  soap  lotion  of  the  con- 
tract should  be  amis.  Outlining  what  each  Vast  la  expected  to  aaecmplisb  and 
how  each  parameter  will  be  detondnsd  should  be  mutually  agreed  upon  between 
8wRI  and  «A. 

9cm  understanding  aa  the  photo  coverage  expected  by  both  parties  should 
be  outlined. 


A total  system  layout  should  be  generated  for  Unas  up  to  $00  fhet  long. 
Zona  slae  should  be  specified,  hiniu— ndsll  fbeding  of  the  system,  each  sene 
and  each  noasle  la  the  eye  test  should  be  determined. 

An  understanding  regarding  the  Items  expects in  tha  Technical  Data 
padkags  should  be  reached. 

Any  data  available  through  MB)  on  the  ohaemsterlsatlsn  of  HT  detonation, 
pressure  warns  rasp suss,  bran  burning  ve lasitlas  sad  behavior,  expected  move- 
ment of  adjoining  beams,  and  dal  ana  linn  tints  Should  be  node  available  to  SwRX. 
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DISTRIBUTION  LIST 


COPY  NO. 


Commander 


US  Arny  Materiel 
ATTN:  AMCRD 

AMCRD-ES 

AMCIS-MD 

AMCPA-E 

AMCRP-I 


Command 

AMCRD -EA 
AMCDL*  • 
AMCMM-S 

AMCSF 


5001  Eisenhower  Avenue 


Alexandria,  VA  22333 


Commander 

USAMC  Installations  4 Services  Directorate 
ATTN:  AMCIS-RI-IU 

Rock  Island,  IL  61201 

Commander 

US  Army  Armament  Command 
ATTN:  AMSAR-FPI-C 

AMSAR-RD 
AM5AR-ISE 
AMSAR-SC 
AMSAR-EN 
AMSAR-PPW 

Rock  Island,  IL  61201 

Project  Manager  for  Munition  Production 
Base  Modernisation  & Expansion 
US  Army  Materiel  Command 
ATTN:  AMCPM-PBM-EC 

AMCFM-PBM-EB 
Dover,  New  Jersey  07801 

Department  of  the  Army 

Ofc  Ch  Research,  Development  and  Acquisition 
ATTN:  DAMA-CSM-P 

Washington,  D.  C.  20310 

Commander 

US  Armjr  Procurement  Equipment  Agency 
ATTN:  AMX-PE-MT 

Rock  Island,  IL  61201 

Department  of  the  Army 
ATTN:  DAEN-ZCE 

Washington,  D.  C.  20310 


1-9 


10 


11-12 

13 

111 

1$ 

16 

17 


18 

19 


20 


21 


22 


COPY  NO. 


Commander 
Edgewood  Arsenal 
ATTN:  SAREA-TD-P 

Aberdeen  Proving  Grounds,  MD  21010 

23 

i i 

Commander 
Frankford  Arsenal 
ATTN:  SARFA-MMT-C  »• 

Philadelphia,  PA  19137 

2U 

Defense  Contract  Administration  Services 
1610  S.  Federal  Building 
100  Liberty  Avenue 
Pittsburgh,  PA  1 522? 

25-26 

Defense  Documentation  Center 
Cameron  Station 
Alexandria,  VA  22311: 

27-38 

Commander 

| US  Army  Construction  Engineeering 

1 Research  Laboratory 

ATTN:  CERL-ER 

Champaign,  IL  61820 

• 

39 

Office  Chief  of  Engineers 
ATTN:  DAEN-MCZ-E 

Washington,  D.  C.  20311: 

1:0-1: 1 

j 

i 

I 


L 


US  Army  Engr  District,  NEW  YORK 
ATTN:  Construction  Div 

26  Federal  Plaza 
New  York,  NY  10007 

US  Army  Engr  District,  BALTIMORE 
ATTN:  Construction  Div 

P.  0.  Box  1715 

Baltimore , MD  21203 

US  Army  Engr  District,  NORFOLK 
ATTN:  Construction  Div 

803  Front  St 
Norfolk,  VA  23510 

US  Army  Engr  District,  MOBILE 
ATTN:  Construction  Div 

P.  0.  Box  2288 
Mobile,  AL  36628 


U2 


U3 


UU 


U5 


57 





COPY  NO 


US  Amy  Engr.  District,  FORT  WORTH 
ATTN:  Construction  Div 

P.  0.  Box  17300 
Ft.  Worth,  TX  76102 

US  A ray  Engr  District  OMAHA 
ATTN:  Construction  Div 

6011  USPO  & Courthouse 
215  North  17th  Street 
Omaha,  NB  68102 

US  Amy  Engr  District,  KANSAS  CITY 
ATTN:  Construction  Div 

700  Federal  Bldg. 

Kansas  City,  MO  6U106 

US  Amy  Engr  District,  SACREMENTO 
ATTN:  Construction  Div 

650  Capitol  Mall 
Sacramento,  CA  958l!i 

US  Amy  Engr  District,  HUNTSVILLE 
ATTN:  ConstructionDiv 

P.  0.  Box  1600  West  Station 
Huntsville , AL  35807 

Commander 

US  Amy  Environmental  Hygiene  Agency 
ATTN:  USAEHA-E 

Aberdeen  Proving  Ground,  MD  21010 
Commander 

Badger  A my  Ammunition  Plant 
ATTN:  SARBA-CE 

Baraboo , WI  53913 

Commander 

Cornhusker  Army  Ammunition  Plant 

ATTN:  SARCO-E 

Grand  Island,  NB  68801 

Commander 

Holston  Amy  Ammunition  Plant 
ATTN:  SARHO-E 

Kingsport,  TN  37662 

Commander 

Indiana  Amy  Ammunition  Plant 
ATTN:  SARIN-OR 

Charlestown,  IN  1*7111 


1*6 


1*7 


W -1*9 


50 


51 


52-53 

5U 

55 


58 


Commander 

Naval  Weapons  Support  Center 
ATTN:  Code  50U2,  Mr.  C.  W.  Gilliam 

Crane , IN  17522 

Commander 

Iowa  Amy  Ammunition  Plant 
ATTN:  SARIO-A 

Burlington,  IA  52601 

Commander 

Joliet  Army  Ammunition  Plant 
ATTN:  SARJ0-5S-E 

Joliet,  IL  602:36 

Commander 

Kansas  Army  Ammunition  Plant 
ATTN:  SARKA-CE 

Parsons,  KS  67537 

Comnander 

Lone  Star  Amy  Ammunition  Plant 
ATTN:  SAELS-IE 

Texarkana,  TX  75501 

Commander 

Longhorn  Army  Ammunition  Plant 
ATTN:  SARLO-C 

Marshall,  TX  75670 

Commander 

Louisiana  Arny  Ammunition  Plant 
ATTN:  SARLA-S 

Shreveport,  LA  71102 

Commander 

Milan  Amy  Ammunition  Plant 
ATTN:  SAHMI-S 

Milan,  TN  38358 

Commander 

Newport  Amy  Ammunition  Plant 
ATTN:  SARNE-S 

Newport,  IN  1:7966 

Commander 
Pine  Bluff  Arsenal 
ATTN:  SARPB-ETA 

Pine  Bluff,  AR  71601 


59 


COPY  NO. 

58 

59 

60 

61 
62 
63 
6U 

65 

66 
67 


Commander 

Radford  Army  Ammunition  Plant 
ATTN:  SARRA-IE 

; Radford,  VA  ?1*U*1 

Commander 

Ravenna  Army  Ammunition  Plant 
Ravenna,  OH  1:1*266 

Commander 

Sunflower  Army  Ammunition  Plant 
ATTN:  SARSU-C 

Lawrence , KS  660l*l* 

Commander 

Volunteer  Army  Ammunition  Plant 
ATTN:  SARVO-T 

Chattanooga,  TN  31*701 

Dr.  John  A.  Brown 
P.  0.  Box  11*5 

Berkeley  Heights,  N.  J.  07922 

Dr.  John  ¥.  Dawson 
Rt.  8 Box  27U 
Durham,  NC  27701: 

Any  Logistics  Management  Center 
Environmental  Management 
ATTN:  LCDR  J.  C.  Bo lander 

Fort  Lee,  VA  23801 

Commander 
Picatinny  Arsenal 
ATTN:  SARPA-CO 

SARPA-MT 
SARPA-MT-S 
SARPA-MT-T 

> SARPA-TS 

SARPA-ND 

SARPA-ND-C 

SARPA-ND-S 

SARPA-ND-T-A 


